How to spot a fake email: 12 tricks with examples (and a free test)

You get hundreds of emails a week. A few of them are trying to trick you. This guide shows the 12 tricks scammers use most, with made-up examples, so you can see them before they land in your own inbox.

Every example here is fictional. The brands, people and addresses are invented, and all the web addresses end in .example, which no one can own.

Try it first: a 20-second video and a free test

After the lessons below you will find a short video and a test with 12 made-up emails. Some are real, some are fake. You pick Real or Fake, and we show the clues.

Want to go straight to it? Jump to the test.

The 5-second check

Before you click anything, ask four things:

1. Did I expect this? A surprise order, prize, invoice or “locked account” is a warning.
2. Who really sent it? Look at the address after the @, not just the name.
3. Where does the link go? Hover over it on a computer. Press and hold on a phone.
4. What does it want? Money, a password, a code, a gift card, new bank details or a quick click?

If anything feels off, stop. Do not click, do not reply. Check by phone using a number you already have.

Trick 1: A fake address that copies your own company

Scammers can make a message look like it came from your own company. Your inbox may check the sender with three tests: SPF, DKIM and DMARC. If your company has set them up well, most of these fakes are thrown away. If not, some get through.

Sometimes a message looks like it came from “us” even though nobody forged anything. See Trick 7 and read our real case study.

Red flags: an “internal” message asking for money or a login, sent by someone who never writes to you.

Trick 2: Lookalike domains

The domain is the part after the @. Scammers register a domain that looks nearly the same.

• rn looks like m. rnoonmart.example is not moonmart.example.
• Capital I looks like small l. cIoudly.example is not cloudly.example.
• An extra word or a hyphen. paybuddy-support.example is not paybuddy.example.
• The real name tucked in front. In northbank.example.pay-secure.example, the real owner is the end: pay-secure.example.
• Letters from other alphabets. Some look the same as ours. Your email app may show these in a strange way.

The CISA phishing guide lists a sender address with “slight character changes” as a sign of phishing.

What to do: if the email asks you to act, do not use its link. Type the website address yourself.

Trick 3: Your boss’s name on a stranger’s address

Anyone can type “Dana Brooks (CEO)” as a display name. Look at the address. A boss does not write from a free mailbox.

The classic ask: “Are you at your desk? Buy gift cards, keep it quiet.” The FBI calls this family of scams business email compromise. In a September 2024 notice, the FBI’s Internet Crime Complaint Center said it had received reports of about $55.5 billion in losses from October 2013 to December 2023.

What to do: call or message your boss on a number you already have.

Trick 4: The Reply-To trap

An email has a “From” and can also have a “Reply-To”. When you press Reply, your answer goes to the Reply-To. A scammer can set the From to look fine and the Reply-To to their own mailbox.

What to do: before you reply, look at the address in the “To” box of your reply. If it is different from the sender, stop.

Trick 5: Mail with no proof it is real

Real companies sign their email. Mail that fails those checks is “unauthenticated”. Many inboxes already put it in spam or show a warning. If you see a banner like “This message may be unsafe” or “We could not verify who sent this”, take it seriously.

Trick 6: Real tools used by scammers

Scammers like to use real services, because the message really does come from the real service.

• App-testing invites. Apple’s TestFlight is a real tool for testing apps. A scammer can add any email address as a “tester”, and the invite then comes from Apple’s own servers.
• File shares. A “document shared with you” from a real sharing service, with a note about your pay.
• Calendar invites. A meeting invite from a stranger with a link in it.
• Invoice and payment requests. A real payment platform sends a “pay this invoice” request that the scammer wrote.

The sender address is real, so it does not help you. The note, the ask and the link are the clues. Ask: do I know this person? Did I expect it? Is it about money or a login?

Trick 7: A group address that re-sends outside mail

Some companies have shared addresses like info@ or sales@. Often these are “groups” that send each message to many people. If a group is open to the public, a stranger can send a message to it and it goes to everyone. Some groups also change the “From” line to say “Sender via Group” and re-sign it, so it can look like it came from the company itself. This is exactly what happened in a real case at our own company.

What to do as a worker: treat odd “via” messages with care. What to do as an owner: lock your groups. The case study shows how.

Trick 8: The fake invoice and the “new bank details”

A scammer copies a real supplier’s invoice and changes the bank account. Or they email “we have changed banks”. This is business email compromise, and it goes after real money.

Red flags: new account numbers by email, a deadline, “do not call”, and a Reply-To that goes somewhere else.

The rule that stops it: never pay to new bank details until you call the supplier on a number you already had (an old invoice, the contract). Write down who you spoke to.

Trick 9: “Your account is locked” and surprise password resets

“We saw a strange sign-in. Verify within 24 hours or lose your account.” It is built to scare you.

Red flags: “Dear Customer”, a clock, a button, and a sender domain that does not match.

What to do: do not use the button. Open the real app or type the real site address yourself. If you did not ask for a password reset, do not use the link in that message.

Trick 10: QR code phishing (quishing)

A QR code hides the web address. You can’t hover over it. And scanning moves the problem to your phone. The FBI warned in January 2022 that criminals were swapping or tampering with QR codes to steal logins and money.

What to do: do not scan a code that arrived in an email, a letter or a sticker you can’t trust. After any scan, read the web address. Do not log in from a QR code.

Trick 11: MFA fatigue (approve, approve, approve)

If a scammer has your password, they try to log in. That sends you a prompt on your phone: “Approve sign-in?” They do it again and again, at night, until you tap Approve to make it stop. CISA calls this “push bombing”.

What to do: never approve a prompt you did not start. Tell IT right away. Ask your company to turn on number matching or, better, phishing-resistant MFA, which CISA recommends.

Trick 12: A real colleague who has been hacked, and attachment tricks

Sometimes the sender address is truly your colleague’s. Their account may have been hacked. The message is short, odd, and not how they write: “are you free? see this voicemail”.

Watch for attachments like voicemail.html, invoice.pdf.html, scan.zip or files that ask you to “enable macros”. A voicemail is not a web page.

What to do: do not open it. Contact your colleague on a different channel. Tell IT fast so they can lock the account.

Real scam emails we received (names and emails hidden)

These are real fake emails that reached our own inboxes. We covered the personal details with black bars. Everything else is exactly how it arrived, so you can see the tricks for yourself.

Spot it: The sender says “Appe ID”, not “Apple ID”. The real address is a long string of random letters on a strange domain. It says you have 24 hours, which is pressure. The link text looks real, but the real link goes somewhere else.

Spot it: The sender address is made of random letters, not the company’s real domain. The grammar is broken (“We detect unauthorize person was accessed”). It scares you about a purchase you never made.

Spot it: The bright yellow “cancel this payment” link is the trap. It leads to a fake login page that steals your password and card. If you are worried about a charge, open the app or type the website yourself.

Spot it: The subject says your account is locked, but the message talks about a late package. That mismatch is a red flag. The sender domain is “shipping-confirm.com”, not the real delivery company. Real delivery firms tell you to track a package on their own app or website.

What to do with a suspicious email

1. Do not click, do not reply, do not open the file.
2. Check by phone. Use a number you already have, not one in the email.
3. Report it. Use the report button or tell IT. Fast reports protect everyone.
4. If you already clicked, read what to do in the next hour.

How businesses stop these tricks

• Set up SPF, DKIM and DMARC for your domain, and move DMARC to “reject” when you are ready. This stops others faking your exact address.
• Turn on spoofing protection in Google Workspace or Microsoft 365: domain spoofing, look-alike names and domains, and unauthenticated mail.
• Lock down mail groups. Invite-only. No outside posting to groups that include all staff.
• Use MFA everywhere, and number matching or phishing-resistant MFA for staff who get prompts.
• Use a call-back rule for any change to payment details.
• Train and test. Short lessons and safe practice emails build the habit of pausing. You can ask for a free phishing test for up to 25 staff.

Sources

• CISA: Avoiding Social Engineering and Phishing Attacks
• FBI IC3: Business Email Compromise: The $55 Billion Scam (PSA240911)
• FBI IC3: Cybercriminals Tampering with QR Codes to Steal Victim Funds (PSA220118)
• CISA: Implementing Phishing-Resistant MFA and Implementing Number Matching in MFA Applications
• FTC: How to Recognize and Avoid Phishing Scams